pat-s
853b924765
## Why bincraft PR #124 makes the `abi_classification` cache authoritative for the risky-package set, breaking the circularity where a package counted as ABI-risky only once it had already been built per-minor. On its own that changes nothing for the packages actually at risk. The cache only holds verdicts for packages that passed through the build pipeline after the per-minor scheme existed; everything older has no verdict, and no verdict means the flat binary is carried into every per-minor index. That is exactly how a `base64enc` built under R 4.4.3 reached an R 4.6.1 client: ``` base64enc.so: undefined symbol: SETLENGTH ``` This is the backfill that gives those packages a verdict. ## What it does `local/backfill-abi-classification.R` enumerates a slot's flat index and runs each compiled package through `bincraft::classify_r_minor_sensitive()`, which looks the verdict up in the cache, and on a miss downloads the CRAN source, classifies it and stores the result. The verdict is a property of the source, independent of OS, arch and R minor, so **one run populates the cache for every slot**. The arch/codename arguments only choose which flat index to enumerate. Only `NeedsCompilation=yes` packages are classified: a package with no compiled code has no symbols to bind and cannot fail this way, so proving it by download would be wasted work. On amd64/resolute that is 4585 packages rather than 23218. Re-running is cheap and resumable: cached verdicts return without touching the network, so a second run costs one query per package and downloads only the remainder. ## Verification The enumeration was run against the live indexes and matches an independent symbol scan of the same slot exactly: ``` flat binaries: 23218 | due classification: 4585 base64enc included: TRUE lobstr included: TRUE ``` 4585 is the same population I scanned with `nm -D --undefined-only` when establishing the blast radius, and both packages confirmed to break under 4.6 are in it. `crow lint` passes. ## Sequencing Merge after bincraft #124 and after a bincraft release the pipelines pick up, otherwise the verdicts are written but nothing reads them yet. Writing them early is harmless. Then re-index the slots so the per-minor indexes are rebuilt with the widened risky set. Expect coverage in the per-minor indexes to *drop* slightly as newly-recognised risky packages are dropped rather than served from a mismatched minor; those then need per-minor builds, either through the normal pipeline or the targeted workflow in devxy/build-cran-binaries#198. Reviewed-on: #199
129 lines
3.7 KiB
R
129 lines
3.7 KiB
R
### Classify every compiled package in a slot's flat index, into the ABI cache.
|
|
#
|
|
# Usage: Rscript local/backfill-abi-classification.R <arch> <codename> [limit]
|
|
#
|
|
# The per-minor scheme only ever classified packages that passed through the
|
|
# build pipeline after it existed. Everything built before that, and not updated
|
|
# on CRAN since, has no verdict at all -- and bincraft's risky set is what
|
|
# decides whether a flat binary may be carried into a per-minor index. With no
|
|
# verdict the answer defaults to "carry it", which is how a base64enc built
|
|
# under R 4.4.3 reached R 4.6 clients and died at dyn.load() on SETLENGTH.
|
|
#
|
|
# The verdict is a property of the source, so it is independent of OS, arch and
|
|
# R minor: one slot's backfill populates the cache for every slot. The slot
|
|
# argument only selects which flat index to enumerate.
|
|
#
|
|
# Only packages with NeedsCompilation=yes are classified. A package with no
|
|
# compiled code has no symbols to bind and cannot fail this way, so downloading
|
|
# its source to prove that would be wasted work.
|
|
#
|
|
# Resumable: `classify_r_minor_sensitive()` returns cached verdicts without
|
|
# touching the network, so a re-run costs one query per package and only the
|
|
# unclassified remainder is downloaded.
|
|
|
|
options(error = function() {
|
|
cat("ERROR:", geterrmessage(), "\n", file = stdout())
|
|
traceback(2)
|
|
q(status = 1)
|
|
})
|
|
|
|
library(bincraft, quietly = TRUE)
|
|
|
|
args <- commandArgs(trailingOnly = TRUE)
|
|
if (length(args) < 2L) {
|
|
stop(
|
|
"usage: backfill-abi-classification.R <arch> <codename> [limit]",
|
|
call. = FALSE
|
|
)
|
|
}
|
|
arch <- args[[1L]]
|
|
codename <- args[[2L]]
|
|
limit <- if (length(args) >= 3L) as.integer(args[[3L]]) else NA_integer_
|
|
|
|
db <- list(
|
|
metadata_db_type = "postgres",
|
|
metadata_db_host = "r-binaries.devxy.io",
|
|
metadata_db_name = "build_metadata",
|
|
metadata_db_port = 15432L,
|
|
metadata_db_user = "rpkgs",
|
|
metadata_db_password = Sys.getenv("PGPASS"),
|
|
metadata_db_sslmode = "require"
|
|
)
|
|
|
|
read_index <- function(index_url) {
|
|
con <- gzcon(url(index_url, open = "rb"))
|
|
on.exit(close(con), add = TRUE)
|
|
read.dcf(con, fields = c("Package", "Version", "Built"))
|
|
}
|
|
|
|
flat <- read_index(sprintf(
|
|
"https://cran.rpkgs.com/%s/%s/latest/src/contrib/PACKAGES.gz",
|
|
arch,
|
|
codename
|
|
))
|
|
# Source fallbacks have no binary to be unsafe, so skip them.
|
|
flat <- flat[!is.na(flat[, "Built"]), , drop = FALSE]
|
|
|
|
cran <- read.dcf(
|
|
gzcon(url(
|
|
"https://cloud.r-project.org/src/contrib/PACKAGES.gz",
|
|
open = "rb"
|
|
)),
|
|
fields = c("Package", "NeedsCompilation")
|
|
)
|
|
compiled <- cran[
|
|
!is.na(cran[, "NeedsCompilation"]) & cran[, "NeedsCompilation"] == "yes",
|
|
"Package"
|
|
]
|
|
|
|
todo <- flat[flat[, "Package"] %in% compiled, , drop = FALSE]
|
|
cat(sprintf(
|
|
"%s/%s: %d binaries in the flat index, %d compiled and due classification\n",
|
|
arch,
|
|
codename,
|
|
nrow(flat),
|
|
nrow(todo)
|
|
))
|
|
if (!is.na(limit) && limit > 0L && limit < nrow(todo)) {
|
|
todo <- todo[seq_len(limit), , drop = FALSE]
|
|
cat(sprintf("Limited to the first %d\n", limit))
|
|
}
|
|
|
|
sensitive <- 0L
|
|
failed <- 0L
|
|
for (i in seq_len(nrow(todo))) {
|
|
pkg <- todo[i, "Package"]
|
|
ver <- todo[i, "Version"]
|
|
verdict <- tryCatch(
|
|
do.call(
|
|
bincraft::classify_r_minor_sensitive,
|
|
c(list(package_name = pkg, tag = ver), db)
|
|
),
|
|
error = function(e) {
|
|
cat(sprintf(" %s %s: %s\n", pkg, ver, conditionMessage(e)))
|
|
NA
|
|
}
|
|
)
|
|
if (is.na(verdict)) {
|
|
failed <- failed + 1L
|
|
} else if (isTRUE(verdict)) {
|
|
sensitive <- sensitive + 1L
|
|
}
|
|
if (i %% 250L == 0L) {
|
|
cat(sprintf(
|
|
" classified %d/%d (%d r-minor-sensitive, %d failed)\n",
|
|
i,
|
|
nrow(todo),
|
|
sensitive,
|
|
failed
|
|
))
|
|
utils::flush.console()
|
|
}
|
|
}
|
|
|
|
cat(sprintf(
|
|
"Done: %d classified, %d r-minor-sensitive, %d failed\n",
|
|
nrow(todo),
|
|
sensitive,
|
|
failed
|
|
))
|